CVE-2009-3955

Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN…

published January 13, 2010

CVSS
—
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky little marker in a Jp2c stream can spell disaster for Adobe Reader and Acrobat versions before 9.3 and 8.2! Think of it like a waiter who serves up a meal with a hidden ingredient that causes a chain reaction in the kitchen — one wrong marker can lead to a messy kitchen fire! If an attacker exploits this vulnerability, they could execute arbitrary code on your system, potentially taking control of your machine or corrupting data. This could lead to compromised information and a massive headache for anyone running these outdated versions!

Put simply

Think of it like a waiter who serves up a meal with a hidden ingredient that causes a chain reaction in the kitchen — one wrong marker can lead to a messy kitchen fire! This vulnerability exists due to an integer sign extension issue that allows attackers to bypass a sanity check, resulting in memory corruption when processing a crafted JPC_MS_RGN marker in the Jp2c stream.

What to do

If an attacker exploits this vulnerability, they could execute arbitrary code on your system, potentially taking control of your machine or corrupting data. This could lead to compromised information and a massive headache for anyone running these outdated versions! Ensure all users upgrade to Adobe Reader and Acrobat 9.3 or higher, and 8.2 or higher on Mac OS X. Additionally, educate users about the risks of opening untrusted files and implement regular software updates to stay protected. You've got this! With these steps, you can safeguard your system from harm. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.15809 · 96.9th percentile
Published
2010-01-13T19:00Z
EPSS history
Timeline
  • 13 JAN 19:00Z
    Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN…
    cvelistv5